ネット証券・銀行口座を狙う「リアルタイム中間者フィッシング（AiTM）」とは？
6桁の確認コードが突破される理由と、パスキーによる確実な守り方

#![forbid(unsafe_code)]

pub const AUTH_DATA_MIN_LEN: usize = 37;
pub const FLAG_USER_PRESENT: u8 = 0b0000_0001;
pub const FLAG_USER_VERIFIED: u8 = 0b0000_0100;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum WebAuthnVerifyError {
    TruncatedAuthenticatorData,
    RpIdHashMismatchAiTmDetected,
    UserPresenceNotAsserted,
    UserVerificationRequiredForFinancialTx,
    ClonedAuthenticatorSignCountRegression { stored: u32, received: u32 },
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct VerifiedAuthHeader {
    pub flags: u8,
    pub new_sign_count: u32,
}

/// Verifies the 37-byte AuthenticatorData header against expected RP ID SHA-256 hash
/// and enforces User Verification (UV) + monotonic signCount against AiTM & token cloning.
#[inline]
pub fn verify_webauthn_auth_data(
    auth_data: &[u8],
    expected_rp_id_sha256: &[u8; 32],
    stored_sign_count: u32,
) -> Result<VerifiedAuthHeader, WebAuthnVerifyError> {
    if auth_data.len() < AUTH_DATA_MIN_LEN {
        return Err(WebAuthnVerifyError::TruncatedAuthenticatorData);
    }

    // 1. Constant-time RP ID Hash verification (blocks AiTM reverse proxies on lookalike domains)
    let mut diff: u8 = 0;
    let mut i: usize = 0;
    while i < 32 {
        diff |= auth_data[i] ^ expected_rp_id_sha256[i];
        i += 1;
    }
    if diff != 0 {
        return Err(WebAuthnVerifyError::RpIdHashMismatchAiTmDetected);
    }

    // 2. Enforce UP (User Present) and UV (User Verified via Biometrics/PIN)
    let flags = auth_data[32];
    if (flags & FLAG_USER_PRESENT) == 0 {
        return Err(WebAuthnVerifyError::UserPresenceNotAsserted);
    }
    if (flags & FLAG_USER_VERIFIED) == 0 {
        return Err(WebAuthnVerifyError::UserVerificationRequiredForFinancialTx);
    }

    // 3. Parse big-endian u32 signCount and detect cloned hardware keys
    let received_count = u32::from_be_bytes([
        auth_data[33],
        auth_data[34],
        auth_data[35],
        auth_data[36],
    ]);
    if (received_count != 0 || stored_sign_count != 0) && received_count <= stored_sign_count {
        return Err(WebAuthnVerifyError::ClonedAuthenticatorSignCountRegression {
            stored: stored_sign_count,
            received: received_count,
        });
    }

    Ok(VerifiedAuthHeader {
        flags,
        new_sign_count: received_count,
    })
}